Privacy
This page says what leaves your phone, to whom, in which country, and what our encryption does not protect. The last part is the one nobody writes, and it is the reason this page exists.
1. This website
The page you are reading is a static file served from a content delivery network. It sets no cookie, runs no analytics tool, and embeds neither social buttons nor third-party fonts: the fonts are downloaded from our own domain, which avoids sending your IP address to a supplier for the sole purpose of displaying a heading.
There is therefore no consent banner, because there is nothing to consent to. Our host keeps technical logs, your IP address and the page requested, for as long as it takes to serve the page and to defend the service against abuse. That is the legitimate interest provided for in Article 6(1)(f) GDPR.
2. The app
What never leaves your phone
- The search index. Searching your memory is a local computation, a few milliseconds long, that sends nothing.
- Text read from a photo. Character recognition runs on the device. The image itself never goes to a vision model.
- Photos you choose not to keep. The default setting is not to keep them.
What does leave it, and why
- When you ask a question or entrust a memory: your message and at most six excerpts from your memory judged useful go to our inference providers. Never your whole memory, whatever its size.
- When you dictate: transcription uses your phone’s own engine. If your phone has no on-device engine for your language, the system falls back to its network engine and the audio then goes to Apple or Google, never to us. The resulting text is then sent once to a model to be proofread, before you confirm it.
- If you have an account: your encrypted backup, your email address, your first name and your language.
The advertising identifier
On first launch, on iPhone and iPad, the app asks for permission to use your device’s advertising identifier, the IDFA. That is the system’s own prompt, not ours, and your answer can be changed at any time in Settings, Privacy & Security, Tracking.
If you accept, that identifier serves one purpose only: knowing which advertisement made you discover the app. On that basis alone it may be shared with the advertising networks we buy space from. None of your memories, none of your questions and none of your contact cards is read, used or shared for this, and nothing you write is ever attached to it.
If you decline, the identifier is not read, nothing is restricted, and you are not asked again. This measurement rests on your consent and on nothing else. On Android there is nothing to ask: the advertising identifier permission is stripped from the package, so the app cannot access it.
3. Encryption, and its limit
Your backup is encrypted with AES-256-GCM, using a key derived for your account alone. A copy of the database yields neither your text, nor your titles, nor the first names you mentioned: it yields nothing at all.
Two further limits, stated plainly. The local storage on your phone is not yet encrypted by us: it is protected by your device lock, not by us. And the vault protects the display, not the model: when you ask a question that bears on a sensitive memory, its text leaves with the excerpts.
4. Who your data goes to
| Processor | What for | What it receives | Outside the EU |
|---|---|---|---|
| Vercel | Hosting of this website | IP address and technical logs, for as long as it takes to serve the page | Yes |
| Supabase | Accounts and the app’s encrypted backup | Email address, first name, encrypted memory | Yes |
| Brevo | Sending emails and the newsletter | Email address, first name, language | No |
| OpenAI and Mistral AI | Understanding your messages inside the app | The message you send and the excerpts useful to the answer | Yes |
Accounts and backups are hosted by Supabase, Inc., c/o Incorporating Services, Ltd., 3500 S. DuPont Highway, Dover, DE 19901, United States, with processing in the United States and in Singapore. This transfer outside the European Union relies on the standard contractual clauses of Implementing Decision (EU) 2021/914, module 2, which that provider publishes and applies.
None of our processors is allowed to train a model on what you entrust to us, or to use it for anything other than delivering the service.
5. For how long
- Your memory: for as long as your account exists. You can delete a single memory, and it disappears from the server in the same gesture.
- Your account: deleted on request, immediately and with no retention period. Deletion takes with it the backed-up memory, the images, the profile and your address at our email provider.
- Technical logs: a few weeks at the host, for the security of the service.
6. Your rights
Access, rectification, erasure, portability, restriction, objection, and the right to withdraw consent at any time. The essentials are exercised directly inside the app, in one gesture and without writing to anyone, which is faster than any procedure.
Otherwise, write to contact@memorypilot.fr. The legal deadline for a reply is one month. You may also lodge a complaint with the CNIL, the competent supervisory authority.
7. Minors
The service is not intended for anyone under fifteen, the age of digital consent in France. We do not knowingly collect their data; if it happened, write to us and the account will be deleted.
8. Changes
This page carries its update date at the top. A change that would reduce your rights or widen what we collect will be announced to you by email before it takes effect, not slipped into a silent revision.
See also the terms of use and the legal notice.